CVE-2023-4916 Login with phone number <= 1.5.6 - Cross-Site Request Forgery to User Password Change

What is CVE-2023-4916?

CVE-2023-4916 is a high-severity vulnerability in glboy OTP Login With Phone Number, OTP Verification, published on 13 Sep 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

The Login with phone number plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.6. This is due to missing nonce validation on the 'lwp_update_password_action' function. This makes it possible for unauthenticated attackers to change user password via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Weakness: CWE-352

Which versions are affected by CVE-2023-4916?

It affects 1 product.

Products include Idehweb Login With Phone Number.

How do I fix CVE-2023-4916?

No fix has been published for CVE-2023-4916 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-4916 being exploited?

There is no known exploitation of CVE-2023-4916 in the wild and no public exploit code.

Other vulnerabilities in glboy OTP Login With Phone Number, OTP Verification

• CVE-2024-6482 Login with phone number <= 1.7.49 - Authenticated (Subscriber+) Authorization Bypass to Privilege Escalation High 8.8
• CVE-2023-23492 SQL injection in Login with Phone Number WordPress Plugin High 8.8
• CVE-2022-0593 Login with phone number < 1.3.7 - Unauthenticated remote plugin deletion Medium 6.5
• CVE-2024-37429 WordPress Login with phone number plugin <= 1.7.35 - Admin+ Cross Site Scripting (XSS) vulnerability Medium 5.9
• CVE-2022-0598 Login with phone number < 1.3.8 - Multiple Admin+ Stored XSS Medium 4.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-qxmq-p4mw-7mw8.